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©,A system for controlling access to broadcast transmissions including a transmitter having a transmission 
encoder for. scrambling the broadcast, a multiplicity of subscriber receivers, each having an identical receiving 
decoder, containing no secret cryptographic keys, for descrambling the broadcast and a plurality of selectable 
and portable executing apparatus each being operatively associatable with .a receiving- decoder at a partially 
different given, time and each executing generally identical operations to generate a seed for use fey the 
associated receiving decoder to enable the receiving decoder to descramble the broadcast. 
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FIELD OF THE INVENTION 



The present invention relates to broadcast transmission Systems and techniques. 

BACKGROUND OF THE INVENTION 

There is known in the patent literature a great variety of systems and techniques for broadcast 
transmission. More particularly systems for controlling access to broadcast transmissions are described in 
the following publication: 

Satellite and Cable TV Scrambling and Descrambling , by Brent Gale and Frank Bayhn, published by 
Baylin/Gaii~Production?, Boulder, Colorado, 1986. 

Smart cards, plastic cards resembling credit cards with microprocessor inside of them, are known in the 
art. They are described in the book.. Smart Cards, The New Bank Cards, by Jerome Svigals and published 
by Macmillan Publishing Company / NY. 1987. 

SUMMARY OF THE INVENTION 

The present invention seeks to provide improved apparatus and techniques for controlling access to 
broadcast transmissions. For the purposes of the present specification and claims, broadcast transmissions 
are deemed to include both audio and video. ; combined and separately, whether transmitted by wire or by 
wireless techniques. 

There is thus provided in accordance with a preferred embodiment of the present invention a system 
for controlling access to broadcast transmissions including a transmitter having a transmission encoder for 
scrambling the broadcast! a multiplicity of subscriber receivers, each having an identical receiving decoder, 
containing no secret cryptographic keys, for descrambling the broadcast and a plurality of selectable and 
portable executing apparatus each being operatively associatabie with a receiving decoder at a part.ally 
different given time and each executing generally identical operations to generate a seed for use by the 
associated receiving decoder to enable the receiving decoder to descramble the broadcast. 

In accordance with a preferred embodiment of the present invention, the executing apparatus includes 
apparatus for actively executing an algorithm. 

In accordance with another embodiment of the present invention, the executing apparatus includes 
apparatus for providing instructions and data for an algorithm executed in the decoder. 

In accordance with one embodiment of the present invention, the executing apparatus includes all of the 
instructions required to descramble the transmission. In accordance with another embodiment of the 
present invention, the executing apparatus provides only part of the instructions required to descramble the 
transmission. 

In accordance with a preferred embodiment of the present invention, the executing apparatus comprises 
apparatus for providing proof of authenticity to the receiving decoder. The proof of authenticity is preferably 
a public key proof of authenticity and preferably a Fiat-Shamir public key proof of authenticity. 

In accordance with a preferred embodiment of the present invention, each executing apparatus contains 
a separate identification element which is sensible by a decoder. 

Further, in accordance with a preferred embodiment of the present invention, each executing apparatus 
comprises an element which indicates programming entitlements to the decoder. 

In accordance with a preferred embodiment of the present invention, the element which indicates 
programming entitlements to the decoder is modified by information contained in the transmitted broadcast. 

In accordance with a preferred embodiment of the present invention, the decoder comprises a mailbox 
for receiving data from broadcast transmissions and from the a first of the plurality of selectable executing 
apparatus. Further, in accordance with a preferred embodiment of the present invention, the executing 
apparatus is operative to access the mailbox. Such data may include, for example, activation data for 
enabling operation of the executing apparatus and entitlement information. 

In accordance with a preferred embodiment of the present invention, the executing apparatus may 
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contain information which can be accessed by the decoder for modifying software thereof. 

In accordance with a preferred embodiment of the present invention, the executing apparatus comprises 
apparatus for generating displayed messages via the decoder. 

In accordance with a preferred embodiment of the present invention, the decoder is operative to 
5 generate displayed messages originating from any of the following sources: the broadcast, the decoder and 
the executing apparatus. 

Further, in accordance with a preferred embodiment of the present invention, the displayed messages 
may be assigned designated priorities. 

There is provided, in accordance with the present invention, a system for transferring information 
70 comprising a plurality of portable card apparatus each comprising microprocessor apparatus for generating 
and transmitting data to be stored and fixed storage apparatus for receiving the data from a first of the 
plurality of card apparatus, for storing the data, and for enabling a second of the. plurality of card apparatus 
to remove the data therefrom. 

There is additionally provided, in accordance with the present invention, a system for transferring 
75 information comprising computing apparatus for generating and transmitting a first set of data to be stored, 
a plurality of portable card apparatus each comprising microprocessor apparatus for generating and 
transmitting a second set of data to be stored and fixed storage apparatus for receiving at least one of the 
first and second data from the computing apparatus and a first of the plurality of card apparatus, for storing 
the information, and for enabling a Second of the plurality of card apparatus to remove the at least one of 
20 the first and second data therefrom. 



BRIEF DESCRIPTION OF THE DRAWING 

25 ". . f- 

The present invention will be understood and appreciated more fully from the following detailed 
description, taken in conjunction with the drawings in which: 

Fig. 1 is a generalized block diagram illustration of a broadcast system constructed and operative in 
accordance with a preferred embodiment of the present invention; 

30 Fig. 2 is a more detailed block diagram illustration of the transmission end of the system of Fig. 1; 
Fig. 3 is a more detailed block diagram illustration of the reception end of the system of Fig. 1; , 
Fig. 4 is a generalized illustration of a communications protocol employed in accordance with a preferred 
embodiment of the invention; \ 
Fig. 5 is an illustration of a information exchange protocol for use with a verifier and a smart card in 

35 accordance with a preferred embodiment of the present invention; and 

Fig. 6 is an illustration of a Fiat-Shamir authentication protocol useful in the present invention. 

DETAILED DESCRIPTION OF A PREFERRED EMBODIMENT 

40 

Reference is now made to Figs. 1 - 3, which illustrate the broadcast system constructed and operative 
in accordance with a preferred embodiment of the present invention. The broadcast system preferably 
comprises a security computer 10, such as an IBM AT having multiple serial communications links: The 

45 security computer 10 receives inputs from a security database computer 12. such as an IBM AT, which 
stores programming information as well as information relating to urgent or periodic subscriber actions. 
Typically an urgent subscriber action could consist of immediate, on-line activation, deactivation or re- 
activation of viewing entitlements. Typically a periodic subscriber action is a blacklisting order or a message 
to be transmitted periodically so that when the subscriber is tuned to the system, the order or message will 

so be received and suitably processed. 

The security computer 10 also receives an input from a subscriber management system 14, typically 
embodied in a large mainframe computer, commercially available from IBM or other major manufacturers. 
The subscriber management system stores- details of all subscribers, their payment status and their., 
entitlements. 

55 In accordance with a preferred embodiment of the .invention, the security computer 10 interfaces with 

one or more smart cards 16. Such smart cards are well known and are described in Smart Cards, The New 
Bank Cards, by Jerome Svigals. The smart cards preferably contain two computer programs. The first 
computer program contains a : seed generating algorithm for producing a seed which is used in signal 
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scrambling and descrambling at both ends of the system. The second program contains a signature 
protocol which appends a suitably hashed signature to afl information regarding entitlements when 
transmitted over the system. 

The security computer 10 supplies data, including, inter alia, unscrambled data, data bearing a 
5 signature and a seed to an encoder 18, which typically is located on the premises of a broadcasting station. 

The operation of the apparatus of elements 10, 12. 14 and 16 may be emulated by a computer program 
whose object code is attached hereto as Annex A. 

The encoder 18 is typically an encoder which is commercially available from Thomson CSF 
Laboratoires Electroniques de Rennes, Cesson-Sevigne, France. The encoder 18 is operative, using the 
w seed received via the security computer 10, to scramble all or part of an audio-video TV program received 
from any suitable program source, such as a VCR. The encoder 18 is also operative to modulate the data 
which is received from the security computer so as to enable both the scrambled program and the data to 
be transmitted together. It will be appreciated that the seed is not modulated and thus, is not transmitted. 

The modulation technique may be selected at will from known techniques provided that it is suitable for 
;s use with the encoder 18. In accordance with a preferred embodiment of the invention, the data is inserted 
on unused video lines. 

The output of the encoder 18 is broadcast by any suitable technique, either by wire or wireless 
^ apparatus! In the illustrated embodiment; the encoder outputs to a ground station 20, which communicates 
via a satellite. 22 in geosynchronous orbit of the earth with a multiplicity of receiving ground stations 24, 
20 each representing a subscriber. 

The signals received by each receiving ground station 24 are supplied to a receiver 26, typically 
commercially available from Amstrad of the UK. The receiver 26 is operative to convert the signals received 
thereby, which are selected by the subscriber, to baseband video. If the baseband video does not require 
descrambling, the receiver 26 remodulates the baseband video typically on a pre-selected channel for 
25 reception and display on a conventional television display 28. 

Scrambled signals are supplied by the receiver 26 to a decoder 30, typically commercially available 
from Ferguson Limited, Enfield, Middlesex, England or from Thomson LE.R.E.A. Illkirch, France. 

: ln accordance with a preferred embodiment of the present invention, the decoder is operative together 
with a smart card 32, which contains a seed generation algorithm. It is a particular feature of the present 
30 invention, that the . decoders contain no cryptographic secrets and that each of the smart cards 32 
associated with the multiplicity of receivers 26 execute the identical seed generation algorithm on the data 
sent from the security computer 10 and thus, produce the identical seed used by encoder 18 to scramble 
the broadcast signal. It is an additional feature of the present invention that the receivers 26 are identical 
and the smart card 32 from one subscriber can operate in the receiver 26 of a second subscriber, thereby 
35 allowing the second subscriber to view, in his home, the programs received by the first subscriber. 

In accordance with an alternative embodiment of the invention, the use of either or both of smart cards 
16 and 32 may . be eliminated in favor of simpler, but less secure memory cards. In such a case, the 
memory card contains data but not the seed generating algorithm. In such a case, the security computer 10 
transmits instructions to the decoder 30 enabling it to use the data in the memory card to reproduce the 
40 seed. 

In the embodiment wherein cards 16 and 32 or at least card 32 is a smart card, the smart card 32 
includes a first program which verifies the genuineness of the hashed signature produced by card 16 and 
transmitted through the system, thus rejecting entitlement data bearing no signature or a non-genuine 
signature. The smart card 32 also contains a program for generating the seed for enabling the decoder to 

45 descramble the video TV program. The object code for a smart card 32 manufactured by News Gem 
Smartcard International Ltd. of Livingston, Scotland, is attached hereto as Annex B.- 

Reference is now made to Fig. 2 which illustrates the transmission apparatus of the present invention. 
As mentioned hereinabove, security computer 10 receives subscriber and programming data from sub- 
scriber management system 14 and security database 12. Security computer 10 sends a portion of the data 

so relating to operations to be performed by smart card 32 to the smart card 16, via a smart card coupler 34, 
such as those commercially available from GemPlus of Gemenos. France. Smart card 16 appends a digital 
signature to the data for smart card 32 whereby the digital signature is generated by the second algorithm 
stored within the smart card 16. The smart card 16 additionally generates the scrambling seed to be used 
by the encoder 18. 

55 the two algorithms stored in smart cards 16 and 32 are typically hashing functions operating on the 
data for smart card 32. The hashing function of the second algorithm, that for digital signature generation, 
typically is iterated a few times. The hashing function of the first algorithm, that for seed generation, 
typically is iterated a multiplicity of times. Hashing functions are described in The Art of Computer 
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Programming, Vol 2:Seminumerical Algorithms by Donald E. Knuth. % 

The data for smart card 32 and the scrambling seed are sent from the srrVart card 16 through the 
security computer 10 to the encoder 18. The scrambling seed in loaded into a Pseudo-Random Bit 
Sequencer (PRBS) 40 which produces from it a pseudo-random sequence of bits. The sequence of bits is 
s sent to a scrambler 42 which utilizes it to scramble the broadcast signal, which may come from a VCR. 

The programming and security data as well as the data for smart card 32 is appended to the scrambled 
broadcast signal, by means of a data inserter 44, and the combined signal is sent to the ground station 20 
to be modulated and transmitted. 

Reference is now made to Fig. 3 which illustrates the reception end of the system of Fig. 1. As 
70 mentioned hereinabove, the combined signal is received by receiving ground, station 24 and is sent to 
receiver 26 which demodulates it into video baseband. The video baseband is then sent in- parallel to both a ' 
descrambler 46 and a data demodulator 48 of decoder 30. 

Data demodulator 48 extracts the data from the combined signal and sends it to a. verifier 50. Verifier 50 ' 
then sends a portion of the data to the smart card 32 for verification of entitlements and for seed generation. 
is The portion of the data which is sent is that dealing with entitlements and seed generation. 

Smart card 32 receives the data portion and, if the entitlement information enclosed therein indicates 
that the subscriber is entitled to view the selected program,.' it utilizes the data portion to generate a 
decoding seed which is generally equivalent to the scrambling, seed. If the subscriber is not entitled to 
receive the video signal, the decoding seed will not match the scrambling seed. Smart card 32 also 
20 generates on-screen displays based on the received data portion. For example, the received data portion) 
typically includes a channeUdentification number and the current date. If the subscriber is not entitled to' 
view the currently selected channel, an on-screen display message such as THIS CHANNEL IS BLOCKED, 
is generated. If the current date is beyond an expiration date stored in smart card 32, an on-screen display 
message such as YOUR CARD HAS EXPIRED is generated. It will be appreciated that typically only one 
25 on-screen display message can be displayed at one time. ' .i ... : ', V 

The generated seed and on-screen displays, if any, are sent to the verifier 50t The verifier 50 sends the 
on-screen displays to an on-screen display inserter 52 which inserts, the display into the baseband vfdeo 
after it has left the descrambler 46. The decoding seed is sent to a PRBS 54 which generates a pseudo- 
random bit sequence, generally identical to the scrambling seed, which is utilized by the descrambler 46 for ; " ; 
30 descrambling the baseband video signal. 

The verifier 50 performs the following six additional functions: 

1; An authentication operation, as described hereinbelow and with reference to Fig. 6, for verifying- that 
the smart card is authentic; ,; 

2. Generation of the decoding seed, in conjunction with the security computer 10, and management of 
35 pay-per-view programs, in the embodiment where the smart card 32 comprises a memory card. The 

algorithm used for seed generation is a hashing function operating on data from the security computer 
10. The result is used as the decoding seed if the results of instructions such as comparisons between 
data stored in the memory card and data sent from the security computer 10 are positive; 

3. comparison of priority levels of on-screen display messages, such as between those generated by 
40 smart card 32 and those sent from the security computer 10, for determining which message should be 

displayed and sending of the message to the on-screen display inserter 52; 

4. display of the smart card 32 identification number upon request from the security computer 10; 

5. blacklisting of smart cards 32 which contain an illegal identification number, as directed by the 
security computer 10; and 

45 6. maintenance of a mailbox used to store messages from an old to a new smart card and from the 
security computer 10 to the smart card 32. Such messages may include enabling of the new'card based 
on the message left by the old card. For pay-per-view systems where the smart card 32 stores the 
amount of money initially paid by the subscriber and deletes a predetermined amount of money for each 
program viewed, at the end of the subscription period, the old smart card 32 leaves in the mailbox an 
50 amount of money left to the subscriber (if any). The new smart card 32 adds to the'amount stored within 
it the amount left in the mailbox. 
Executable code for a verifier 50 incorporated into an 8052 processor from Intel is attached hereto as 
Annex C. 

The on-screen display inserter 52 inserts the on-screen display m.€lsages into the baseband video 
55 output of the descrambler 46 and the combined signal is sent to the receiver 26 for remodulation and for 
transmission to the TV set 28. 3 
Reference is now made to Fig. 4 which illustrates a communications protocol typically used in the , 
system of the present invention. Beginning at the lowest level, the physical level, the ground station 
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transmitter 20 transmits 8 broadcast signal via a satellite link to a receiver apparatus 60 which comprises 
ground station receiver 24 and receiver 26. 

• At the data level, the data is inserted into the vertical blanking interval of the broadcast signal via the 
data inserter 44 of the encoder 18 and Amoved via the data demodulator 48 of decoder 30. The encoder 
5 18 and decoder 30 may communicate between themselves without affecting the operation of the system of 
the present invention. 

At the session level, the security computer 10 communicates with the verifier 50 of decoder 30 via data 
packets of the data. In the preferred embodiment of the present invention, the data packets are 32-byte 
packets. The information passed is system and subscriber information, authorization to perform the 

w authentication operation and/or to display the smart card identification number, as described hereinabove. 
The session level communicates with the data level via an RS-232 protocol between the security computer 
10 and the encoder 18 and via a parallel communication protocol, described in Annex D, between the 
verifier 50 and the data demodulator 48. 

Finally, the application level is a communication level between the smart card 16 attached to the 

is security computer 10 and the smart card 32 attached to the decoder 30. The information passed relates to 
seed and signature generation, and channel and date information. 

Reference is now made to Fig. 5 which illustrates a communications protocol between smart card 32 
and verifier 50. Verifier 50 sends a data packet to the smart card 32 and the smart card 32 operates on the 
data packet to generate a decoding seed arid on-screen display messages. Additionally, the smart card 32 

20 receives mail from the mailbox of verifier 50 as well as sends mail to the mailbox. 

In accordance with a preferred embodiment of the present invention, the verifier 50 reads the card 
identification number of the smart card 32 which is stored in the memory of the smart card. Moreover, upon 
instruction from the security computer 10, as transmitted in the data packet, the verifier 50 and smart card 
32 perform an authentication process. 

25 , The authentication process is illustrated in Fig. 6 and discussed in detail in U.S. Patent 4,748.668 to 
Shamir which is incorporated herein by reference. Smart card 32 has stored in it a card identification 
number, denoted V in Fig 6, a second number, denoted 5. and a modulus N, which is also stored in verifier 
50. N is a public modulus which is a multiple of two values P and Q where P and Q are two prime numbers, 
typically of many digits, known only to the system which generates the smart cards. 5 is defined as: 

30 S = (VV)'Mod N (1) • * . ' 

where the square root is performed as a modular square root. Modular arithmetic is discussed on pages 
•268-278 of The Art of Computer Programming, Vol. 2:Seminumerical Algorithms , written by Donald E. Knuth 
and publishedT>y~Add> son - Wes,e y Publishing Company, Reading. Massachusetts. 

The authentication process operates as follows. Verifier 50 requests a number X from smart card 32 

35 . where X is defined as: 
X = R 2 *Mod N (2) 

where R is an arbitrary number. The verifier 50 then responds with a query bit Q, received from the security 
computer 10, whose value is randomly either 0 or 1. The smart card 32 then responds with a value Y where 

Y is defined as: 

40 Y = RifQ = 0 (3) 

Y = (R'S)'Mod N if Q = 1 (4) 

The smart card 32 is authenticated if the verifier 50 calculates the following values for Y 2 . 
Y 2 = X*Mod N if Q = 0 (5) 
Y 2 = (X-V)'Mod N if Q = 1 (6) 
45 where the verifier 50 received V from the smart card 32 prior to the authentication process. 

It will be appreciated by persons skilled in the art that the present inventions is- not limited by what has 
been particularly shown and described hereinabove. Rather the scope of the present invention is defined 
only by the claims which follow: 

50 
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Annex D: Protocol For Communication Between Verifier and Data demodulator 

The data demodulator and verifier chip are connected by means of a parallel 8 bit link. The data 
demodulator is the master and the verifier is the slave. The hand-shaking requests 4 control lines: 
RWN: read/write output from the data demodulator; 
SENDN: output from the data demodulator; 
ACKN: output from the verifier chip; 
RESET: reset line from the verifier chip. 
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Writing a byte to the verifier chip: 

The timing traces for data from the data demodulator to the verifier are shown on the next page. The 
verifier is in input mode with its data lines in high impedance. When the data demodulator is ready tp send 
a byte, it sets RWN and SENDN to 0, after having tested if ACKN is high. At the same time, it outputs the 
data on the bus. After having stored the data, the verifier chip asserts' it by setting ACKN to 0. Then the 
data demodulator sets SENDN to 1 and releases the data bus. To end the transfer, the verifier chip sets 
ACKN to 1 . 

The verifier chip has to answer to the SENDN request before a time-out (T4 max). In case the data 
demodulator does not receive an acknowledge, (ACKN = 0) within this time, it releases the data bus and 
sets SENDN to 1. 
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Reading a byte from the verifier chip: 

The timing traces for data from the verifier chip to the data demodulator are shown hereinbelow. When 
the Locde needs data and if ACKN is high, it sets RWN to 1 and SENDN to 0. When the , verier ,s ready 
to send t outputs- the data and clears ACKN, in order to infrom that the data ,s yal.o. Aftej the data 
demodulator h£ stored the data, it sets SENDD to 1. Then the verifier chip re leases the 
impedance and sets ACKN to 1 as soon as possible. There is no fme-out secunty P™*d p th. ««■••■ 

The data demodulator is the master since it is synchronout with the TV l.nes. The use of the ACKN l.ne 
allows a slow CPU for the verifier chip. 
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Software Specifications: 



Data demodulator to Verifier Chip: 

After the acquisition of a packet, the data demodulator transmits it to the verifier" chip. The transfer 
between the two chips is done in the manner shown below. 
| DATA PACKET (32 bytes) | INFO | | ACK | 
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The DATA PACKET is comprised of 32 corrected bytes dedicated to the verifier chip. This information 
is received, data demodulator and corrected by the data demodulator. 

The INFO byte is one byte long. It contains information from the data demodulator for the verifier and is 
sent by the data demodulator. Bit 0 \$ used as a PUSH bit. A value of 1 indicates that a validation push 
5 button on the TV was pushed for more than three seconds. The data demodulator sends this information 
only one time and waits for the key to be depressed. In order to inform the user that his order has been 
accepted, the state of the displayed information will be changed (e.g. to a blinking mode) after the pushed 
button has been detected. Bits 1-7 are not currently used. 

The ACK byte is sent by the verifier chip after the data demodulator sends the 33 bytes of data packet 
w and INFO to verify that the data was received. If bit 0 is set to 1 then the verifier chip received the 33 bytes. 
If bit 0 is set to 0, the data demodulator sends the 33 bytes repeatedly until the bit is set to 1. Bits 1-7 are 
not currently used. 

In case a time-out occurs during the packet transfer, the data demodulator attempts to send this byte 
again until the transfer succeeds. In order to be ready for the loading of a new control word, if there is no 
J5 sufficient time to complete the packet transfer, the data demodulator will cancel the transfer and RESET the 
verifier chip before the key changeover occurs. 

. Verifier chip to data demodulator: 

20 

10ms before the control word chages (line 0. 64, 128 or 192). the data demodulator asks for the new 
control- word. Whatever happens, the verifier chip as to answer. Therefore, line SENDN should be 
connected to an interrupt line from the verifier chip. The data format of the answer is shown below. 
| CONTROL WORD (8 bytes). | L | OSD | 
25 * The 8 bytes of the CONTROL WORD contain the result of the smart card computation. 

, The L byte is one byte long indicating the length of an on-screen display. If L is 0. then the data 
demodulator has to switch >off a device (OSD - on screen display inserter) for displaying the on screen 
display. If L is between 0 and 255. the data demodulator will receive an on screen message whose length is 
L. If L is 255, the OSD remains in its current state. 
30 The L OSD bytes contain the information to be displayed by the OSD. 
The verifier chip piri setup is shown on the next page. 



87 



EP 0 428 252 A2 



PO.O 


DATAI/O 


P2.0 


C4N 


PO.1 


CMDVCCN 


P2.1 


C8N 


P0.2 


CMDVPPN 


P2.2 


CMD3.5N 


P0.3 


VPP5N 


P2.3 


CMD7N 


PO.4 


VPP12.5N 


P2.4 




P0.5 


VPP21N 


P2.5 




P0.6 


RSTN 


P2.6 




P0.7 


C3CLK 


P2.7 




P1.0 


DO 


P3.0 




P1.1 


D1 


P3.1 




P1.2 


D2 


P3.2 


DETECT 


P1.3 


D3 


P3.3 


SENDN 


P1.4 


D4 


P3.4 


: RWN 


P1.5 


D5 


P3.5 


ACKN 


P1..6 


D6 


P3.6 




P1.7 


D7 


P3.7 




The name of the signals which are active 
low are ended by N. 



Claims 



1 A system for controlling access to broadcast transmissions comprising: 
a transmitter having a transmission encoder for scrambling a broadcast; and 

: n 7de^ — —scrambling s*d broadcast; 

rlralitv of selectable and portable executing means each being operatively associatable with a receiving 
decode at a 9^X different given time and each executing generally identical operations to genera e a 
seed for use by said associated receiving decoder to enable said receiving decoder to descramb.e said 

^ system as in claim 1 and wherein said executing means includes means for active.y executing an 

a'TsSem as in claim 1 and wherein said executing means includes means for providing instructions and 
data for an algorithm executed in said decoder. -j-„„ , n mci'mrHnn* 

4 A system as in claim 1 and wherein said executing means includes means for proving all instruct.ons 
reauired to descramble said transmission. 

5 A system as in claim 1 and wherein said executing means includes means for pro.v.dmg a porfon of 
instructions required to descramble said transmission. . 

6 A system as in claim 1 and wherein said executing means comprises means for proving proof of 
aiithpntiritv to said receiving decoder. 

7 A system as in claim 6 and wherein said executing means comprises a pub.ic.key proof o authent.cty. 
8. A system as in claim 6 and wherein said executing means comprises a Fiat-Sham.r pubhc key proof of 

rHSi as in claim 1 and wherein each executing means contains a separate identification element 

;o hiC r:yslt b ? S i y n a c"ri er and wherein each executing means comprises an element which indicates 



88 



EP 0 428 252 A2 



\<4 



programming entitlements to said decoder. 

11. A system as in claim 10 and wherein said element which indicates programming entitlements to said 
decoder is modified by information contained in said transmitted broadcast. 
(• y 12. A system as in claim 1 and wherein said decoder comprises a mailbox for receiving data from 

I ;i 5 broadcast transmissions and from a first of said plurality of selectable and portable executing means, 
i ; 13. A system as in claim 12 and wherein said executing means is operative to access said mailbox. 

I 14. A system as in claim 12 and wherein said data from broadcast transmissions and from said first of said 

/ ;< plurality of selectable and portable executing means comprises entitlement information and activation data 

i t for enabling operation of said new apparatus removably associatable with said decoder, 

i; w 15. A system as in claim 1 and wherein said executing means may contain information which can be 
. ) . accessed by said decoder for modifying software thereof. 

I I 16. A system as in claim 1 and wherein said executing means comprises means for generating displayed 

.1 ff&-" messages via said decoder. 

I .j' 17. A system as in claim 1 and wherein said decoder is operative to generate displayed messages 

( -|| 75 originating from any of the following sources: said broadcast, said decoder and said executing means, 
if; 18. A system as in claim 16 and wherein said displayed messages may be assigned designated priorities. 

^Sfpfe/ 19. A system for transferring information comprising: 

a plurality of portable card means each comprising microprocessor means for generating and transmitting 
data to be stored; and 

20 fixed storage means for receiving said data from a first of said plurality of card means, for storing said data, 
and for enabling a second of said plurality of card means to remove said data therefrom. 
7.| 20. A system for transferring information comprising: 

yf. computing means for generating and transmitting a first set of data to be stored; 

a plurality of portable card means each comprising microprocessor means for generating and transmitting a 
-)/ 25 second set of data to be stored; and 



% 



fixed storage means for receiving at least one of said first and second data from said computing means and 
a first of said plurality, of card means, for storing said information, and for enabling a second of said plurality 
of card means to remove said at least one of said first and second data therefrom. 
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® A system for controlling access to broadcast 
transmissions including a transmitter having a trans- 
mission encoder for scrambling the broadcast, a 
multiplicity of subscriber receivers, each having an 
identical receiving decoder, containing no secret 
cryptographic keys, for descrambling the broadcast 
and a plurality of selectable and portable executing 
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apparatus each being operatively associatable with a 
receiving decoder at a partially different given time 
and each executing generally identical operations to 
generate a seed for use by the associated receiving 
decoder to enable ths receiving decoder to de- 
scramble the broadcast. 
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